https://seclists.org/oss-sec/2026/q3/766: CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

Q: Who is affected in practice?

Administrators who have the ClientApp update entitlement but do not also have the ClientApp create entitlement are unable to update ClientApp resources. The issue is an authorization failure rather than an indication that unauthorized users can gain update access.

Q: What entitlement is required as a workaround if upgrading cannot happen immediately?

The affected authorization logic checks the ClientApp create entitlement for both ClientApp creation and updates. Granting the create entitlement to an administrator who must update ClientApps would allow the operation, but it also grants ClientApp creation capability.

Q: How can I determine whether an instance is affected?

Check the version of the syncope-core-am-logic component. Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; upgrading to 4.0.8 or 4.1.3 fixes the issue.

Published Sep 14, 2026

Updated

Affected Software

3 affected components

Apache Syncope>=3.0.0-M0<=3.0.16

Apache Syncope>=4.0.0-M0<=4.0.7

Apache Syncope>=4.1.0-M0<=4.1.2

Frequently Asked Questions

Who is affected in practice?

Administrators who have the ClientApp update entitlement but do not also have the ClientApp create entitlement are unable to update ClientApp resources. The issue is an authorization failure rather than an indication that unauthorized users can gain update access.

What entitlement is required as a workaround if upgrading cannot happen immediately?

The affected authorization logic checks the ClientApp create entitlement for both ClientApp creation and updates. Granting the create entitlement to an administrator who must update ClientApps would allow the operation, but it also grants ClientApp creation capability.

How can I determine whether an instance is affected?

Check the version of the syncope-core-am-logic component. Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; upgrading to 4.0.8 or 4.1.3 fixes the issue.